이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Overview
VPN monitoring provides visibility into your devices’ VPN tunnels within Network Device Monitoring (NDM). This feature allows you to keep track of critical data and metrics to examine the health of your VPN tunnels.
When configured, the SNMP check collects VPN tunnel data from your devices. This can be configured for individual as well as Autodiscovered devices.
Prerequisites
Agent version 7.70 or higher.
Limitations
- Support is limited to Cisco IPsec VPN tunnels.
Configuration
Install or upgrade the Datadog Agent to v7.70+.
Edit the snmp.d/conf.yaml file in the conf.d/ folder at the root of your Agent’s configuration directory for individual devices, or the datadog.yaml Agent configuration file for Autodiscovery.
To enable VPN monitoring to all manually configured devices, add the collect_vpn configuration in the init_config section:
init_config:
loader: core
use_device_id_as_hostname: true
collect_vpn: true # (default false) enable collecting VPN tunnel data
instances:
- ip_address: '1.2.3.4'
community_string: 'sample-string'
tags:
- 'key1:val1'
- 'key2:val2'
Or, apply the collect_vpn configuration per instance:
init_config:
loader: core
use_device_id_as_hostname: true
instances:
- ip_address: '1.2.3.4'
community_string: 'sample-string'
tags:
- 'key1:val1'
- 'key2:val2'
collect_vpn: true # (default false) enable collecting VPN tunnel data
To enable VPN monitoring to all Autodiscovery subnets, add the collect_vpn configuration under the network_devices.autodiscovery section:
network_devices:
autodiscovery:
workers: 100
discovery_interval: 3600
loader: core
use_device_id_as_hostname: true
collect_vpn: true # (default false) enable collecting VPN tunnel data
configs:
- network_address: 10.10.0.0/24
loader: core
snmp_version: 2
port: 161
community_string: '***'
tags:
- "key1:val1"
- "key2:val2"
Viewing VPN tunnels
To view VPN tunnels for a device, click the device in the NDM device list or the Device Topology Map to open the NDM device view. The Dependencies section shows the number of connected devices and VPN tunnels at a glance.
Click View dependencies to open the full device page. On the Dependencies tab, select the VPN filter to see all VPN tunnels for the device. The table displays the local outside IP, remote peer IP, protocol, tunnel interface, destination subnets, bytes in, bytes out, and active time for each tunnel.
Metrics collected
The following metrics are made available after enabling VPN monitoring:
| Metric Name | Description |
|---|
snmp.cipSecTunActiveTime | The duration the tunnel has been active in hundredths of seconds. |
snmp.cipSecTunHcInOctets | The number of octets received by the tunnel. |
snmp.cipSecTunHcOutOctets | The number of octets sent by the tunnel. |
snmp.cipSecTunInPkts | The number of packets received by the tunnel. |
snmp.cipSecTunOutPkts | The number of packets sent by the tunnel. |
snmp.cipSecTunInAuthFails | The number of inbound authentications that ended in failure for the tunnel. |
snmp.cipSecTunOutAuthFails | The number of outbound authentications that ended in failure for the tunnel. |
snmp.cipSecTunInDecryptFails | The number of inbound decryptions that ended in failure for the tunnel. |
snmp.cipSecTunOutEncryptFails | The number of outbound encryptions that ended in failure for the tunnel. |
Troubleshooting
If you experience issues using VPN monitoring, use the following troubleshooting guidelines. If you need further assistance, contact Datadog support.
VPN tunnels not displayed
The VPN tunnel data is collected with SNMP. If VPN tunnels are missing on a device, verify the following:
- Datadog Agent version 7.70 or later is installed.
- Verify the device exposes the relevant VPN tunnel data with SNMP by running the following command:
sudo -u dd-agent datadog-agent snmp walk <DEVICE_IP> 1.3.6.1.4.1.9.9.171.1.3.2
Further Reading
